Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Windows Security Center: Achtung! Computer gesperrt - mich hat's auch erwischt (https://www.trojaner-board.de/109030-windows-security-center-achtung-computer-gesperrt-mich-hats-erwischt.html)

s.hoffmann 04.02.2012 03:56
Windows Security Center: Achtung! Computer gesperrt - mich hat's auch erwischt
 
Hallo,

mich hat es beim surfen vorhin auch erwischt.

Ich habe mir diesen Trojaner/Virus eingefangen der 100€ von mir haben und meine Daten löschen will.

Mittlerweile bin ich im abgesicherten Modus unterwegs und habe den OTL Scan durchlaufen lassen.

Ich wäre euch dankbar, wenn ihr mir weiter helfen könntet.

Anbei die beiden Logfiles.

OTL.txt

Code:
OTL logfile created on: 04.02.2012 01:54:29 - Run 1
OTL by OldTimer - Version 3.2.31.0    Folder = F:\Desktop
 Enterprise Edition N Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,97 Gb Total Physical Memory | 1,39 Gb Available Physical Memory | 70,72% Memory free
6,85 Gb Paging File | 6,29 Gb Available in Paging File | 91,78% Paging File free
Paging file location(s): f:\pagefile.sys 5000 5000 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 24,32 Gb Total Space | 8,41 Gb Free Space | 34,58% Space Free | Partition Type: NTFS
Drive F: | 208,47 Gb Total Space | 194,67 Gb Free Space | 93,38% Space Free | Partition Type: NTFS
 
Computer Name: NB-SHO | User Name: *** | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - F:\Desktop\OTL.exe (OldTimer Tools)
PRC - F:\APP\VideoLAN\VLC\vlc.exe ()
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - F:\APP\FirefoxPortable\FirefoxPortable.exe (PortableApps.com)
PRC - F:\APP\FirefoxPortable\App\Firefox\firefox.exe (Mozilla Corporation)
PRC - F:\APP\FirefoxPortable\App\Firefox\plugin-container.exe (Mozilla Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Windows\Temp\nsfBA5B.tmp\registry.dll ()
MOD - C:\Windows\Temp\nsfBA5B.tmp\System.dll ()
MOD - C:\Windows\Temp\nsfBA5B.tmp\newadvsplash.dll ()
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libvorbis_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libxml_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libtaglib_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libtheora_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libswscale_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libzip_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libwaveout_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libyuy2_i420_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libvout_wrapper_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libyuy2_i422_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libyuvp_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libugly_resampler_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libqt4_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libskins2_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libschroedinger_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libspeex_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libscaletempo_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libstream_filter_rar_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libsimple_channel_mixer_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libscale_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libstream_filter_record_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libpng_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libmp4_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libmpgatofixed32_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libplaylist_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libmono_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libmpeg_audio_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\liblibass_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\liblua_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libi420_rgb_sse2_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libi420_rgb_mmx_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libi420_rgb_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libi420_yuy2_sse2_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libhotkeys_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libi422_yuy2_sse2_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libi420_yuy2_mmx_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libi420_yuy2_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libi422_yuy2_mmx_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libi422_yuy2_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\liblpcm_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libmemcpymmxext_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libglobalhotkeys_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libi422_i420_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libgrey_yuv_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libfreetype_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libfaad_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libflac_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libfluidsynth_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libdvdnav_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libdshow_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libdtstofloat32_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libdirectx_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libdirect3d_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libdummy_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libfilesystem_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libdts_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libfake_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libdtstospdif_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libdolby_surround_decoder_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libfloat32_mixer_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libdrawable_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libavcodec_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libaout_sdl_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libblend_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libaout_directx_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libaraw_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libcdg_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libaes3_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libconverter_fixed_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\libvlccore.dll ()
MOD - F:\APP\VideoLAN\VLC\vlc.exe ()
MOD - F:\APP\VideoLAN\VLC\libvlc.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\libaccess_bd_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\liba52tofloat32_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\liba52_plugin.dll ()
MOD - F:\APP\VideoLAN\VLC\plugins\liba52tospdif_plugin.dll ()
MOD - C:\Programme\WinRAR\RarExt.dll ()
MOD - F:\APP\FirefoxPortable\App\Firefox\js3250.dll ()
MOD - F:\DATEV\PROGRAMM\B0000391\DokSchutzShExt.dll ()
MOD - C:\Programme\Common Files\Adobe\Shell\psicon.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (AdobeARMservice) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (DATEV Update-Service) -- F:\DATEV\PROGRAMM\INSTALL\DvInesASDSvc.Exe (DATEV eG)
SRV - (avgwd) -- C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (DVckService) -- F:\DATEV\PROGRAMM\B0000150\ScServer\DVckService.exe (DATEV eG)
SRV - (SCardService) -- F:\DATEV\PROGRAMM\B0000347\ScMgmt\SCardService.exe (DATEV eG)
SRV - (StorSvc) -- C:\Windows\System32\StorSvc.dll (Microsoft Corporation)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (DatevPrintService) -- F:\DATEV\PROGRAMM\B0001442\PSNTServ.exe (DATEV eG)
SRV - (ScReadSpool) -- C:\Programme\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe (VoyagerSoft, LLC)
SRV - (Apache2) -- C:\Program Files\TC\Server\xampplite\apache\bin\Apache.exe (Apache Software Foundation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (SCR3XX2K) -- C:\Windows\System32\drivers\SCR3XX2K.sys (SCM Microsystems Inc.)
DRV - (Avgtdix) -- C:\Windows\System32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) -- C:\Windows\system32\DRIVERS\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgmfx86) -- C:\Windows\System32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (truecrypt) -- C:\Windows\System32\drivers\truecrypt.sys (TrueCrypt Foundation)
DRV - (AVGIDSEH) -- C:\Windows\system32\DRIVERS\AVGIDSEH.Sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgldx86) -- C:\Windows\System32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (vmbus) -- C:\Windows\system32\drivers\vmbus.sys (Microsoft Corporation)
DRV - (storflt) -- C:\Windows\system32\drivers\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) -- C:\Windows\system32\drivers\storvsc.sys (Microsoft Corporation)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (RdpVideoMiniport) -- C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV - (VMBusHID) -- C:\Windows\system32\drivers\VMBusHID.sys (Microsoft Corporation)
DRV - (s3cap) -- C:\Windows\system32\drivers\vms3cap.sys (Microsoft Corporation)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (L1E) -- C:\Windows\System32\drivers\L1E62x86.sys (Atheros Communications, Inc.)
DRV - (MTsensor) -- C:\Windows\System32\drivers\ATKACPI.sys (ATK0100)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=ironto&s={searchTerms}&f=4
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://192.168.135.64/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 81 3A 6B 5D D3 D1 CB 01  [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.669: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.669: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2012.02.03 09:23:25 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.02.04 00:34:56 | 000,000,000 | ---D | M]
 
[2012.01.21 12:58:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions
[2012.01.19 10:58:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions-BackupByFirefoxPortable
[2012.01.19 10:58:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions-BackupByFirefoxPortable\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2011.09.26 12:54:56 | 000,002,049 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fcmdSrch.xml
 
O1 HOSTS File: ([2011.02.22 10:35:48 | 000,001,565 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: 192.168.128.1        ps1
O1 - Hosts: 192.168.128.2        ps2
O1 - Hosts: 192.168.128.3        ps3
O1 - Hosts: 192.168.135.1        tc1
O1 - Hosts: 192.168.135.2        tc2
O1 - Hosts: 192.168.135.3        tc3
O1 - Hosts: 192.168.135.5        tc5
O1 - Hosts: 192.168.135.6        tc1a
O1 - Hosts: 192.168.135.12        tc12
O1 - Hosts: 192.168.135.12        kulsa-ag.finanzen
O1 - Hosts: 192.168.135.12        tc-franchise-rechnungen
O1 - Hosts: 192.168.135.12        dawo-rechnungen
O1 - Hosts: 192.168.135.62        tc-notes-behringen
O1 - Hosts: 192.168.135.80        tcfda
O1 - Hosts: 192.168.135.80  pathchecker
O1 - Hosts: 192.168.135.80  tcnet
O1 - Hosts: 192.168.135.82  tc-script
O1 - Hosts: 192.168.136.1        berlin
O1 - Hosts: 192.168.136.5        polen
O1 - Hosts: 192.168.136.6        esb
O1 - Hosts: 192.168.136.11        hs1
O1 - Hosts: 192.168.136.12        hs2
O1 - Hosts: 192.168.136.13        hs3
O1 - Hosts: 192.168.136.21        hs1a
O1 - Hosts: 9 more lines...
O2 - BHO: (Solid Converter PDF) - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Programme\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll (VoyagerSoft, LLC)
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Programme\BabylonToolbar\BabylonToolbar\1.4.35.10\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programme\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Programme\facemoods.com\facemoods\1.4.17.11\bh\facemoods.dll (facemoods.com BHO)
O2 - BHO: (DealPly) - {A6174F27-1FFF-E1D6-A93F-BA48AD5DD448} - C:\Programme\DealPly\DealPlyIE.dll (DealPly Technologies Ltd)
O2 - BHO: (SCardBHOEvent Class) - {AF8CD625-E04A-4A8F-A90A-0C74846C2E30} - F:\DATEV\SYSTEM\DVCCSASCardBHO002.dll (DATEV eG)
O3 - HKLM\..\Toolbar: (Solid Converter PDF) - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Programme\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll (VoyagerSoft, LLC)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Programme\BabylonToolbar\BabylonToolbar\1.4.35.10\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (facemoods Toolbar) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Programme\facemoods.com\facemoods\1.4.17.11\facemoodsTlbr.dll (facemoods.com)
O4 - HKLM..\Run: [AUTOSTARTEXECUTE] F:\DATEV\PROGRAMM\Install\DvInesAutostartHelper.Exe (DATEV eG)
O4 - HKLM..\Run: [AVG_TRAY] C:\Programme\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [DATEV_SCardMan] F:\DATEV\PROGRAMM\B0000347\ScMgmt\SCardManager.exe (DATEV eG)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [DVCCSAWTSSetEntryNTE] F:\DATEV\PROGRAMM\B0000150\ScWTS\DVCCSAWTSSetEntryNTE.exe (DATEV eG)
O4 - HKLM..\Run: [facemoods] C:\Program Files\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe (facemoods.com)
O4 - HKLM..\Run: [SiPaHost] F:\DATEV\PROGRAMM\B0000398\SiPaHost.exe (DATEV eG)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [vasja] C:\Windows\Temp\0.9549214043420116.exe (Orb Networks)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: datev.at ([]http is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datev.at ([]https is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datev.com ([]http is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datev.com ([]https is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datev.de ([]http is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datev.de ([]https is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datev.de ([www] http is out of zone range -  5)
O15 - HKCU\..Trusted Domains: datev.de ([www] https is out of zone range -  5)
O15 - HKCU\..Trusted Domains: datevnet.de ([*.services] http is out of zone range -  5)
O15 - HKCU\..Trusted Domains: datevnet.de ([*.services] https is out of zone range -  5)
O15 - HKCU\..Trusted Domains: datevstadt.de ([]http is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datevstadt.de ([]https is out of zone range - 5)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.20.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{013A8FF7-8AF9-4989-97B0-480E56573584}: DhcpNameServer = 192.168.2.2
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{67F7BFFF-89AD-49CA-BB75-4382641B4CA3}: DhcpNameServer = 192.168.135.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6DB33068-86F3-4364-9E99-BAA1879D6486}: DhcpNameServer = 192.168.20.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D298D99F-289F-4D9E-B82B-7C7061AE9DB6}: DhcpNameServer = 192.168.135.254
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programme\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\ScCertProp: DllName - (wlnotify.dll) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{17bf3180-3dd1-11e0-8e52-0026180fe28e}\Shell - "" = AutoRun
O33 - MountPoints2\{17bf3180-3dd1-11e0-8e52-0026180fe28e}\Shell\AutoRun\command - "" = E:\Password.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.02.04 01:52:37 | 000,584,192 | ---- | C] (OldTimer Tools) -- F:\Desktop\OTL.exe
[2012.02.04 01:36:32 | 000,000,000 | ---D | C] -- F:\Desktop\Desktop-Zeug
[2012.02.04 00:37:58 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\DDMSettings
[2012.02.04 00:32:03 | 000,927,072 | ---- | C] (DivX, LLC) -- F:\Desktop\DivXInstaller_8.2.1.exe
[2012.01.25 00:07:02 | 000,000,000 | ---D | C] -- F:\Desktop\Rechnung Zalando-Dateien
[2012.01.19 15:14:28 | 000,314,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\webio.dll
[2012.01.19 15:14:28 | 000,015,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sspisrv.dll
[2012.01.19 10:58:35 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Mozilla
[2012.01.15 21:01:14 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\FullTiltPoker
[2012.01.15 21:00:48 | 000,000,000 | ---D | C] -- C:\Program Files\Full Tilt Poker
[2012.01.11 11:17:15 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\packager.dll
[2012.01.11 11:17:14 | 001,328,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll
[2012.01.11 11:17:14 | 000,514,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\qdvd.dll
[2012.01.11 02:07:03 | 000,000,000 | ---D | C] -- F:\Desktop\Vortrag NGWS
[2010.08.25 18:59:08 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll
 
========== Files - Modified Within 30 Days ==========
 
[2012.02.04 01:52:38 | 000,584,192 | ---- | M] (OldTimer Tools) -- F:\Desktop\OTL.exe
[2012.02.04 01:30:38 | 000,653,928 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.02.04 01:30:38 | 000,615,810 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.02.04 01:30:38 | 000,129,800 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.02.04 01:30:38 | 000,106,190 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.02.04 01:26:22 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.02.04 00:50:55 | 000,014,960 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.02.04 00:50:55 | 000,014,960 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.02.04 00:34:58 | 000,002,064 | ---- | M] () -- C:\Users\Public\Desktop\DivX Plus Converter.lnk
[2012.02.04 00:34:58 | 000,001,511 | ---- | M] () -- F:\Desktop\DivX Movies.lnk
[2012.02.04 00:34:29 | 000,001,084 | ---- | M] () -- C:\Users\Public\Desktop\DivX Plus Player.lnk
[2012.02.04 00:32:03 | 000,927,072 | ---- | M] (DivX, LLC) -- F:\Desktop\DivXInstaller_8.2.1.exe
[2012.02.03 20:58:42 | 088,091,593 | ---- | M] () -- C:\Windows\System32\drivers\AVG\incavi.avm
[2012.02.03 12:58:39 | 000,293,214 | ---- | M] () -- C:\Windows\System32\drivers\AVG\iavichjg.avm
[2012.02.03 09:23:31 | 000,000,941 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2011.lnk
[2012.02.01 09:55:28 | 000,249,268 | ---- | M] () -- F:\Desktop\Rekla Ex Partner 01-12.php.pdf
[2012.02.01 09:52:39 | 000,189,041 | ---- | M] () -- F:\Desktop\Rekla akt Partner 01-12.php.pdf
[2012.01.31 02:48:58 | 000,059,618 | ---- | M] () -- F:\Desktop\Stellenbeschreibung.pdf
[2012.01.25 00:07:08 | 000,006,017 | ---- | M] () -- F:\Desktop\Rechnung Zalando.htm
[2012.01.13 17:13:43 | 000,650,749 | ---- | M] () -- F:\Desktop\RV akt-LP lang.pdf
[2012.01.13 17:07:49 | 000,096,800 | ---- | M] () -- F:\Desktop\RV akt-LP kurz.pdf
[2012.01.13 17:04:29 | 000,095,139 | ---- | M] () -- F:\Desktop\RV Ex-LP lang.pdf
[2012.01.13 16:57:12 | 000,060,397 | ---- | M] () -- F:\Desktop\RV Ex-LP kurz.pdf
 
========== Files Created - No Company Name ==========
 
[2012.02.04 00:34:58 | 000,001,511 | ---- | C] () -- F:\Desktop\DivX Movies.lnk
[2012.02.04 00:34:29 | 000,001,084 | ---- | C] () -- C:\Users\Public\Desktop\DivX Plus Player.lnk
[2012.02.04 00:34:07 | 000,002,064 | ---- | C] () -- C:\Users\Public\Desktop\DivX Plus Converter.lnk
[2012.02.01 09:55:26 | 000,249,268 | ---- | C] () -- F:\Desktop\Rekla Ex Partner 01-12.php.pdf
[2012.02.01 09:52:36 | 000,189,041 | ---- | C] () -- F:\Desktop\Rekla akt Partner 01-12.php.pdf
[2012.01.31 02:48:56 | 000,059,618 | ---- | C] () -- F:\Desktop\Stellenbeschreibung.pdf
[2012.01.25 00:07:01 | 000,006,017 | ---- | C] () -- F:\Desktop\Rechnung Zalando.htm
[2012.01.13 17:13:40 | 000,650,749 | ---- | C] () -- F:\Desktop\RV akt-LP lang.pdf
[2012.01.13 17:07:48 | 000,096,800 | ---- | C] () -- F:\Desktop\RV akt-LP kurz.pdf
[2012.01.13 17:04:27 | 000,095,139 | ---- | C] () -- F:\Desktop\RV Ex-LP lang.pdf
[2012.01.13 16:57:10 | 000,060,397 | ---- | C] () -- F:\Desktop\RV Ex-LP kurz.pdf
[2011.09.14 07:20:31 | 000,098,304 | ---- | C] () -- C:\Windows\System32\redmonnt.dll
[2011.06.07 07:18:39 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2011.05.03 08:33:56 | 000,004,096 | -H-- | C] () -- C:\Users\***\AppData\Local\keyfile3.drm
[2011.03.18 09:52:45 | 000,000,021 | ---- | C] () -- C:\Windows\DvInesKurusOleServer003.INI
[2011.03.18 09:51:36 | 000,000,088 | ---- | C] () -- C:\Windows\dvinesinstalllocation001.INI
[2011.03.18 09:51:35 | 000,000,088 | ---- | C] () -- C:\Windows\dvinesinstart001.INI
[2011.03.18 09:49:25 | 000,000,089 | ---- | C] () -- C:\Windows\Startup.INI
[2011.02.23 13:23:49 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe
[2011.02.23 13:22:49 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2010.08.25 19:30:02 | 000,439,308 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin
[2010.08.25 19:30:00 | 000,982,240 | ---- | C] () -- C:\Windows\System32\igkrng500.bin
[2010.08.25 19:30:00 | 000,092,356 | ---- | C] () -- C:\Windows\System32\igfcg500m.bin
[2010.08.25 18:57:00 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config
[2010.08.25 18:52:00 | 000,208,896 | ---- | C] () -- C:\Windows\System32\iglhsip32.dll
[2010.08.25 18:52:00 | 000,143,360 | ---- | C] () -- C:\Windows\System32\iglhcp32.dll
[2009.09.17 14:07:34 | 000,038,496 | ---- | C] () -- C:\Windows\System32\JNILibrary.dll
[2009.09.17 14:07:26 | 000,112,224 | ---- | C] () -- C:\Windows\System32\INetCert.dll
[2009.09.01 01:11:21 | 000,653,928 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2009.09.01 01:11:21 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2009.09.01 01:11:21 | 000,129,800 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2009.09.01 01:11:21 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2009.07.14 05:55:27 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 05:02:04 | 000,472,376 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009.07.14 03:05:48 | 000,615,810 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009.07.14 03:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009.07.14 03:05:48 | 000,106,190 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009.07.14 03:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009.07.14 03:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009.07.14 03:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009.07.14 00:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009.07.13 23:09:19 | 000,139,824 | ---- | C] () -- C:\Windows\System32\igfcg500.bin
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

< End of report >
und die Extra.txt

Code:
OTL Extras logfile created on: 04.02.2012 01:54:29 - Run 1
OTL by OldTimer - Version 3.2.31.0    Folder = F:\Desktop
 Enterprise Edition N Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,97 Gb Total Physical Memory | 1,39 Gb Available Physical Memory | 70,72% Memory free
6,85 Gb Paging File | 6,29 Gb Available in Paging File | 91,78% Paging File free
Paging file location(s): f:\pagefile.sys 5000 5000 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 24,32 Gb Total Space | 8,41 Gb Free Space | 34,58% Space Free | Partition Type: NTFS
Drive F: | 208,47 Gb Total Space | 194,67 Gb Free Space | 93,38% Space Free | Partition Type: NTFS
 
Computer Name: NB-SHO | User Name: *** | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "F:\APP\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "F:\APP\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 24
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5FCFEBE0-EBDA-42A5-BC6E-67B94A47D6F0}" = kobdfu x64x86 driver installation
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{735DEB9C-61BD-4D31-994B-92395BBB4E45}" = Microsoft XML Parser
"{73AA12E1-5FFD-4545-9A28-CE7C318F284E}" = AVG 2011
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{A0516415-ED61-419A-981D-93596DA74165}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{26454C26-D259-4543-AA60-3189E09C5F76}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00B2-0409-0000-0000000FF1CE}" = Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{9BC76CCE-A9EC-4A3A-9B51-D823805E1D1F}" = SolidConverterPDF
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.0) - Deutsch
"{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}" = Full Tilt Poker
"{E533E637-FB3E-4F28-8B18-449CC9AB7235}" = AVG 2011
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Photoshop 7.0" = Adobe Photoshop 7.0
"AVG" = AVG 2011
"BabylonToolbar" = Babylon toolbar on IE
"CCleaner" = CCleaner
"DATEVB00000482.0" = DATEV Installation V.2.8
"DealPly" = DealPly
"DivX Setup" = DivX-Setup
"ENTERPRISE" = Microsoft Office Enterprise 2007
"facemoods" = Facemoods Toolbar
"InfraRecorder" = InfraRecorder
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"RealPlayer 12.0" = RealPlayer
"TrueCrypt" = TrueCrypt
"UTAX TA Product Library" = UTAX TA Product Library
"VLC media player" = VLC media player 1.1.11
"WinRAR archiver" = WinRAR 4.01 (32-Bit)
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"FoxTab PDF Converter" = FoxTab PDF Converter
"FoxTab PDF Creator" = FoxTab PDF Creator
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 03.02.2012 20:12:57 | Computer Name = NB-SHO | Source = VSS | ID = 13
Description =
 
Error - 03.02.2012 20:12:57 | Computer Name = NB-SHO | Source = VSS | ID = 8193
Description =
 
Error - 03.02.2012 20:12:57 | Computer Name = NB-SHO | Source = VSS | ID = 13
Description =
 
Error - 03.02.2012 20:12:57 | Computer Name = NB-SHO | Source = VSS | ID = 8193
Description =
 
Error - 03.02.2012 20:13:42 | Computer Name = NB-SHO | Source = VSS | ID = 13
Description =
 
Error - 03.02.2012 20:13:42 | Computer Name = NB-SHO | Source = VSS | ID = 8193
Description =
 
Error - 03.02.2012 20:13:42 | Computer Name = NB-SHO | Source = VSS | ID = 13
Description =
 
Error - 03.02.2012 20:13:42 | Computer Name = NB-SHO | Source = VSS | ID = 8193
Description =
 
Error - 03.02.2012 20:13:42 | Computer Name = NB-SHO | Source = VSS | ID = 13
Description =
 
Error - 03.02.2012 20:13:42 | Computer Name = NB-SHO | Source = VSS | ID = 8193
Description =
 
[ OSession Events ]
Error - 04.07.2011 05:57:19 | Computer Name = NB-SHO | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session
lasted 3460 seconds with 1860 seconds of active time.  This session ended with a
 crash.
 
Error - 04.07.2011 07:04:42 | Computer Name = NB-SHO | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session
lasted 1105 seconds with 240 seconds of active time.  This session ended with a
crash.
 
Error - 04.07.2011 08:16:59 | Computer Name = NB-SHO | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session
lasted 4210 seconds with 180 seconds of active time.  This session ended with a
crash.
 
[ System Events ]
Error - 23.12.2011 04:56:19 | Computer Name = NB-SHO | Source = Schannel | ID = 36870
Description = Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der
 Anmeldeinformationen Client für SSL. Der vom kryptografischen Modul zurückgegebene
 Fehlercode lautet 0x8009001d. Der interne Fehlerstatus ist 10014.
 
Error - 23.12.2011 04:56:19 | Computer Name = NB-SHO | Source = Schannel | ID = 36870
Description = Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der
 Anmeldeinformationen Client für SSL. Der vom kryptografischen Modul zurückgegebene
 Fehlercode lautet 0x8009030d. Der interne Fehlerstatus ist 10003.
 
Error - 23.12.2011 04:56:20 | Computer Name = NB-SHO | Source = Schannel | ID = 36870
Description = Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der
 Anmeldeinformationen Client für SSL. Der vom kryptografischen Modul zurückgegebene
 Fehlercode lautet 0x8009001d. Der interne Fehlerstatus ist 10014.
 
Error - 23.12.2011 04:56:20 | Computer Name = NB-SHO | Source = Schannel | ID = 36870
Description = Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der
 Anmeldeinformationen Client für SSL. Der vom kryptografischen Modul zurückgegebene
 Fehlercode lautet 0x8009030d. Der interne Fehlerstatus ist 10003.
 
Error - 23.12.2011 04:56:21 | Computer Name = NB-SHO | Source = Schannel | ID = 36870
Description = Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der
 Anmeldeinformationen Client für SSL. Der vom kryptografischen Modul zurückgegebene
 Fehlercode lautet 0x8009001d. Der interne Fehlerstatus ist 10014.
 
Error - 23.12.2011 04:56:21 | Computer Name = NB-SHO | Source = Schannel | ID = 36870
Description = Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der
 Anmeldeinformationen Client für SSL. Der vom kryptografischen Modul zurückgegebene
 Fehlercode lautet 0x8009030d. Der interne Fehlerstatus ist 10003.
 
Error - 01.01.2012 15:32:36 | Computer Name = NB-SHO | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?29.?12.?2011 um 01:17:25 unerwartet heruntergefahren.
 
Error - 01.01.2012 15:45:06 | Computer Name = NB-SHO | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?01.?01.?2012 um 20:39:14 unerwartet heruntergefahren.
 
Error - 01.01.2012 16:00:15 | Computer Name = NB-SHO | Source = Microsoft-Windows-HAL | ID = 12
Description = Der Speicher wurde beim letzten Leistungsübergang des Systems von
der Plattformfirmware beschädigt. Überprüfen Sie, ob für Ihr System aktualisierte
 Firmware verfügbar ist.
 
Error - 02.01.2012 03:01:47 | Computer Name = NB-SHO | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?02.?01.?2012 um 01:08:21 unerwartet heruntergefahren.
 
 
< End of report >
Schon einmal vorab vielen Dank für eure schnelle Hilfe.

Viele Grüße und noch ein schönes Wochenende...

kira 04.02.2012 07:46
Hallo und Herzlich Willkommen! :)

Bevor wir unsere Zusammenarbeit beginnen, [Bitte Vollständig lesen]:
Zitat:
  • "Fernbehandlungen/Fernhilfe" und die damit verbundenen Haftungsrisken:
    - da die Fehlerprüfung und Handlung werden über große Entfernungen durchgeführt, besteht keine Haftung unsererseits für die daraus entstehenden Folgen.
    - also, jede Haftung für die daraus entstandene Schäden wird ausgeschlossen, ANWEISUNGEN UND DEREN BEFOLGUNG, ERFOLGT AUF DEINE EIGENE VERANTWORTUNG!
  • Charakteristische Merkmale/Profilinformationen:
    - aus der verwendeten Loglisten oder Logdateien - wie z.B. deinen Realnamen, Seriennummer in Programm etc)- kannst Du herauslöschen oder durch [X] ersetzen
  • Die Systemprüfung und Bereinigung:
    - kann einige Zeit in Anspruch nehmen (je nach Art der Infektion), kann aber sogar so stark kompromittiert sein, so dass eine wirkungsvolle technische Säuberung ist nicht mehr möglich bzw Du es neu installieren musst
  • Ich empfehle Dir die Anweisungen erst einmal komplett durchzulesen, bevor du es anwendest, weil wenn du etwas falsch machst, kann es wirklich gefährlich werden. Wenn du meinen Anweisungen Schritt für Schritt folgst, kann eigentlich nichts schief gehen.
  • Innerhalb der Betreuungszeit:
    - ohne Abspräche bitte nicht auf eigene Faust handeln!- bei Problemen nachfragen.
  • Die Reihenfolge:
    - genau so wie beschrieben bitte einhalten, nicht selbst die Reihenfolge wählen!
  • GECRACKTE SOFTWARE werden hier nicht geduldet!!!!
  • Ansonsten unsere Forumsregeln:
    - Bitte erst lesen, dann posten!-> Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten?
  • Alle Logfile mit einem vBCode Tag eingefügen, das bietet hier eine gute Übersicht, erleichtert mir die Arbeit! Falls das Logfile zu groß, teile es in mehrere Teile auf.

Sobald Du diesen Einführungstext gelesen hast, kannst Du beginnen:)
Zitat:
Wenn ein System kompromittiert wurde, ist das System nicht mehr vertrauenswürdig
Eine Neuinstallation garantiert die rückstandsfreie Entfernung der Infektion - Lesestoff: "Hilfe: Ich wurde das Opfer eines Hackerangriffs. Was soll ich tun?" - Säubern eines gefährdeten Systems
Falls du doch für die Systemreinigung entscheidest - Ein System zu bereinigen kann ein paar Tage dauern (je nach Art der Infektion), kann aber sogar so stark kompromittiert sein, so dass eine wirkungsvolle technische Säuberung ist nicht mehr möglich bzw Du es neu installieren musst::

► Der Rechner wird nur privat verwendet?

Für Vista und Win7:
Wichtig: Alle Befehle bitte als Administrator ausführen! rechte Maustaste auf die Eingabeaufforderung und "als Administrator ausführen" auswählen
Auf der angewählten Anwendung einen Rechtsklick (rechte Maustaste) und "Als Administrator ausführen" wählen!

1.
Zitat:
Achtung wichtig!:
Falls Du selber im Logfile Änderungen vorgenommen hast, musst Du durch die Originalbezeichnung ersetzen und so in Script einfügen! sonst funktioniert nicht!
(Benutzerordner, dein Name oder sonstige Änderungen durch X, Stern oder andere Namen ersetzt)
Fixen mit OTL
  • Starte die OTL.exe.
  • Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
  • Kopiere folgendes Skript:
Code:
:OTL
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=ironto&s={searchTerms}&f=4
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp
[2011.09.26 12:54:56 | 000,002,049 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fcmdSrch.xml
O4 - HKCU..\Run: [vasja] C:\Windows\Temp\0.9549214043420116.exe (Orb Networks)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{17bf3180-3dd1-11e0-8e52-0026180fe28e}\Shell - "" = AutoRun
O33 - MountPoints2\{17bf3180-3dd1-11e0-8e52-0026180fe28e}\Shell\AutoRun\command - "" = E:\Password.exe

:Commands
[purity]
[emptytemp]

Zitat:
Versuche jetzt den Rechner im normalen Modus zu starten!
2.
Lade Dir Malwarebytes Anti-Malware von→ malwarebytes.org
  • Installieren und per Doppelklick starten.
  • Deutsch einstellen und gleich mal die Datenbanken zu aktualisieren - online updaten
  • "Komplett Scan durchführen" wählen (überall Haken setzen)
  • wenn der Scanvorgang beendet ist, klicke auf "Zeige Resultate"
  • Alle Funde - falls MBAM meldet in C:\System Volume Information - den Haken bitte entfernen - markieren und auf "Löschen" - "Ausgewähltes entfernen") klicken.
  • Poste das Ergebnis hier in den Thread - den Bericht findest Du unter "Scan-Berichte"
eine bebilderte Anleitung findest Du hier: Anleitung

3.
Im Internet Explorer, als bevorzugte Startseite selbst zugefügt?:
Code:
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://192.168.135.64/
4.
Hast du es denn in der Hosts selbst eingetragen bzw absichtlich zugefügt? Wenn ja, warum?
Code:
O1 - Hosts: 192.168.128.1        ps1
O1 - Hosts: 192.168.128.2        ps2
O1 - Hosts: 192.168.128.3        ps3
O1 - Hosts: 192.168.135.1        tc1
O1 - Hosts: 192.168.135.2        tc2
O1 - Hosts: 192.168.135.3        tc3
O1 - Hosts: 192.168.135.5        tc5
O1 - Hosts: 192.168.135.6        tc1a
O1 - Hosts: 192.168.135.12        tc12
O1 - Hosts: 192.168.135.12        kulsa-ag.finanzen
O1 - Hosts: 192.168.135.12        tc-franchise-rechnungen
O1 - Hosts: 192.168.135.12        dawo-rechnungen
O1 - Hosts: 192.168.135.62        tc-notes-behringen
O1 - Hosts: 192.168.135.80        tcfda
O1 - Hosts: 192.168.135.80  pathchecker
O1 - Hosts: 192.168.135.80  tcnet
O1 - Hosts: 192.168.135.82  tc-script
O1 - Hosts: 192.168.136.1        berlin
O1 - Hosts: 192.168.136.5        polen
O1 - Hosts: 192.168.136.6        esb
O1 - Hosts: 192.168.136.11        hs1
O1 - Hosts: 192.168.136.12        hs2
O1 - Hosts: 192.168.136.13        hs3
O1 - Hosts: 192.168.136.21        hs1a
5.
Hast Du zur Zone Vertrauenswürdige Sites absichtlich hinzugefügt?:
Code:
O15 - HKCU\..Trusted Domains: datev.at ([]http is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datev.at ([]https is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datev.com ([]http is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datev.com ([]https is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datev.de ([]http is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datev.de ([]https is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datev.de ([www] http is out of zone range -  5)
O15 - HKCU\..Trusted Domains: datev.de ([www] https is out of zone range -  5)
O15 - HKCU\..Trusted Domains: datevnet.de ([*.services] http is out of zone range -  5)
O15 - HKCU\..Trusted Domains: datevnet.de ([*.services] https is out of zone range -  5)
O15 - HKCU\..Trusted Domains: datevstadt.de ([]http is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datevstadt.de ([]https is out of zone range - 5)
6.
wenn nicht absichtlich installiert, kannst deinstallieren:
Zitat:
Babylon toolbar
- meiste Toolbars bzw Browserhelper wollen sich doch nur wichtig machen;)

7.
Code:
Facemoods Toolbar
lustige Smileys, denoch kann sehr lästig sein, ich würde darauf verzichten!

8.
Um festzustellen, ob veraltete oder schädliche Software unter Programme installiert sind, ich würde gerne noch all deine installierten Programme sehen:
Lade dir das Tool CCleaner herunter
→ Download
installieren (Software-Lizenzvereinbarung lesen, falls angeboten wird "Füge CCleaner Yahoo! Toolbar hinzu" abwählen)→ starten→ Sprache → Deutsch auswählen
dann klick auf "Extra (um die installierten Programme auch anzuzeigen)→ weiter auf "Als Textdatei speichern..."
wird eine Textdatei (*.txt) erstellt, kopiere dazu den Inhalt und füge ihn da ein

9.
erneut einen Scan mit OTL:
  • Doppelklick auf die OTL.exe
  • Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
  • Oben findest Du ein Kästchen mit Ausgabe.
    Wähle bitte Standard-Ausgabe
  • Unter Extra-Registrierung wähle bitte Benutze SafeList.
  • Mache Häckchen bei LOP- und Purity-Prüfung.
  • Klicke nun auf Scan links oben.
  • Wenn der Scan beendet wurde werden zwei Logfiles erstellt.
    Du findest die Logfiles auf Deinem Desktop => OTL.txt und Extras.txt
  • Poste die Logfiles in Code-Tags hier in den Thread.

Zitat:
Damit dein Thread übersichtlicher und schön lesbar bleibt, am besten nutze den Code-Tags für deinen Post:
→ vor dein Log schreibst Du (also am Anfang des Logfiles):[code]
hier kommt dein Logfile rein - z.B OTL-Logfile o. sonstiges
→ dahinter - also am Ende der Logdatei: [/code]
** Möglichst nicht ins internet gehen, kein Online-Banking, File-sharing, Chatprogramme usw
gruß
kira

s.hoffmann 04.02.2012 15:50
Hallo Kira,

als erstes einmal vielen Dank für die superschnelle Hilfe!

Zu den einzelnen Punkten:

zu 1.

- das Skript hat soweit fuktioniert, anbei der Inhalt der Textdatei nach dem Neustart

Code:
All processes killed
========== OTL ==========
HKLM\SOFTWARE\Microsoft\Internet Explorer\Search\\SearchAssistant| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache| /E : value set successfully!
C:\Programme\Mozilla Firefox\searchplugins\fcmdSrch.xml moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\vasja deleted successfully.
C:\Windows\Temp\0.9549214043420116.exe moved successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{17bf3180-3dd1-11e0-8e52-0026180fe28e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{17bf3180-3dd1-11e0-8e52-0026180fe28e}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{17bf3180-3dd1-11e0-8e52-0026180fe28e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{17bf3180-3dd1-11e0-8e52-0026180fe28e}\ not found.
File E:\Password.exe not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrator
->Temp folder emptied: 2884525 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 456 bytes
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
 
User: S. Hoffmann
->Temp folder emptied: 20261433 bytes
->Temporary Internet Files folder emptied: 2635069 bytes
->Java cache emptied: 1653577 bytes
->Flash cache emptied: 948 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1094736142 bytes
RecycleBin emptied: 110338 bytes
 
Total Files Cleaned = 1.070,00 mb
 
 
OTL by OldTimer - Version 3.2.31.0 log created on 02042012_110533

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

zu 2.

- Malwarebytes habe ich installiert, einen kompletten Scan durchlaufen lassen und die infizierten Dateien gelöscht, nachfolgend das Scan-Ergebnis

Code:
Malwarebytes Anti-Malware (Test) 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.02.04.02

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
S. Hoffmann :: NB-SHO [Administrator]

Schutz: Aktiviert

04.02.2012 13:24:21
mbam-log-2012-02-04 (13-24-21).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 319851
Laufzeit: 1 Stunde(n), 38 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FoxTab PDF Converter (Adware.InstallCore) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Program Files\FoxTabPDFConverter\Uninstall\Uninstall.exe (Adware.InstallCore) -> Erfolgreich gelöscht und in Quarantäne gestellt.
F:\_OTL\MovedFiles\02042012_110533\C_Windows\Temp\0.9549214043420116.exe (Trojan.VUPX.ON1) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

zu 3. & 4. & 5.

- ist alles Absicht; um evtl. zu Hause noch bei Bedarf für den Job was erledigen zu können


zu 6. & 7.

- die beiden Toolbars habe ich deinstalliert


zu 8.

- cccleaner war schon installiert, habe bei der Gelegenheit mal wieder aktuallisiert, anbei die installierten Programme

Code:
Adobe Flash Player 10 ActiveX        Adobe Systems Incorporated        26.09.2011        6,00MB        10.3.183.10
Adobe Flash Player 11 Plugin        Adobe Systems Incorporated        16.11.2011        6,00MB        11.1.102.55
Adobe Photoshop 7.0        Adobe Systems, Inc.        21.02.2011                7.0
Adobe Reader X (10.1.0) - Deutsch        Adobe Systems Incorporated        24.07.2011        118,4MB        10.1.0
AVG 2011        AVG Technologies        02.02.2012                10.0.1424
CCleaner        Piriform        03.02.2012                3.15
DATEV Installation V.2.8                10.05.2011               
DivX-Setup        DivX, LLC        03.02.2012                2.6.1.5
FoxTab PDF Converter                13.09.2011               
FoxTab PDF Creator                25.09.2011               
InfraRecorder                21.02.2011               
Java(TM) 6 Update 24        Oracle        20.02.2011        97,1MB        6.0.240
Malwarebytes Anti-Malware Version 1.60.1.1000        Malwarebytes Corporation        03.02.2012        17,3MB        1.60.1.1000
Microsoft .NET Framework 4 Client Profile        Microsoft Corporation        20.02.2011        38,8MB        4.0.30319
Microsoft .NET Framework 4 Client Profile DEU Language Pack        Microsoft Corporation        20.02.2011        2,94MB        4.0.30319
Microsoft Office Enterprise 2007        Microsoft Corporation        20.02.2011                12.0.6425.1000
Microsoft Office File Validation Add-In        Microsoft Corporation        09.10.2011        7,95MB        14.0.5130.5003
Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs        Microsoft Corporation        20.02.2011        0,12MB        12.0.4518.1014
Microsoft Silverlight        Microsoft Corporation        13.10.2011        60,4MB        4.0.60831.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053        Microsoft Corporation        23.01.2012        0,25MB        8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable        Microsoft Corporation        14.06.2011        0,29MB        8.0.61001
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570        Microsoft Corporation        05.06.2011        0,58MB        9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148        Microsoft Corporation        20.02.2011        0,58MB        9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161        Microsoft Corporation        14.06.2011        0,59MB        9.0.30729.6161
MSXML 4.0 SP3 Parser        Microsoft Corporation        17.03.2011        1,48MB        4.30.2100.0
MSXML 4.0 SP3 Parser (KB973685)        Microsoft Corporation        12.07.2011        1,53MB        4.30.2107.0
OpenOffice.org 3.3        OpenOffice.org        20.02.2011        413MB        3.3.9567
PDFCreator        Frank Heindörfer, Philip Chinery        19.10.2011                1.2.3
RealPlayer        RealNetworks        30.10.2011               
SolidConverterPDF        SolidDocuments        21.02.2011        41,7MB        3.1.437.0
TrueCrypt        TrueCrypt Foundation        21.02.2011                7.0a
UTAX TA Product Library        Kyocera Mita Corporation        21.02.2011                2.0.0713
VLC media player 1.1.11        VideoLAN        27.12.2011                1.1.11
WinRAR 4.01 (32-Bit)        win.rar GmbH        19.07.2011                4.01.0

zu 9.

- anbei noc die beiden Ergebnis-Files des erneuten OTL-Scans

OTL.txt

Code:
OTL logfile created on: 04.02.2012 15:33:53 - Run 2
OTL by OldTimer - Version 3.2.31.0    Folder = F:\Desktop
 Enterprise Edition N Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,97 Gb Total Physical Memory | 1,10 Gb Available Physical Memory | 56,15% Memory free
6,85 Gb Paging File | 5,81 Gb Available in Paging File | 84,86% Paging File free
Paging file location(s): f:\pagefile.sys 5000 5000 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 24,32 Gb Total Space | 9,68 Gb Free Space | 39,81% Space Free | Partition Type: NTFS
Drive F: | 208,47 Gb Total Space | 194,66 Gb Free Space | 93,37% Space Free | Partition Type: NTFS
Drive X: | 3,99 Gb Total Space | 3,99 Gb Free Space | 100,00% Space Free | Partition Type: FAT32
 
Computer Name: NB-SHO | User Name: S. Hoffmann | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - F:\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
PRC - C:\Programme\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Programme\AVG\AVG10\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Programme\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Programme\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Programme\AVG\AVG10\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Programme\AVG\AVG10\avgam.exe (AVG Technologies CZ, s.r.o.)
PRC - F:\APP\FirefoxPortable\FirefoxPortable.exe (PortableApps.com)
PRC - F:\APP\FirefoxPortable\App\Firefox\firefox.exe (Mozilla Corporation)
PRC - F:\APP\FirefoxPortable\App\Firefox\plugin-container.exe (Mozilla Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\calc.exe (Microsoft Corporation)
PRC - F:\DATEV\PROGRAMM\B0000150\ScServer\DVckService.exe (DATEV eG)
PRC - F:\DATEV\PROGRAMM\B0000150\ScWTS\DVCCSAWTSSetEntryNTE.exe (DATEV eG)
PRC - F:\DATEV\PROGRAMM\B0000347\ScMgmt\SCardManager.exe (DATEV eG)
PRC - F:\DATEV\PROGRAMM\B0000347\ScMgmt\SCardService.exe (DATEV eG)
PRC - F:\DATEV\PROGRAMM\B0000398\SiPaHost.exe (DATEV eG)
PRC - F:\DATEV\PROGRAMM\B0001442\PSNTServ.exe (DATEV eG)
PRC - C:\Programme\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe (VoyagerSoft, LLC)
PRC - C:\Programme\TC\Server\xampplite\apache\bin\Apache.exe (Apache Software Foundation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Windows\Temp\nsw9676.tmp\System.dll ()
MOD - C:\Windows\Temp\nsw9676.tmp\newadvsplash.dll ()
MOD - C:\Windows\Temp\nsw9676.tmp\registry.dll ()
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Programme\DivX\DivX Update\DivXUpdateCheck.dll ()
MOD - C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
MOD - C:\Programme\WinRAR\RarExt.dll ()
MOD - F:\APP\FirefoxPortable\App\Firefox\js3250.dll ()
MOD - F:\DATEV\PROGRAMM\B0000391\DokSchutzShExt.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (AdobeARMservice) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (DATEV Update-Service) -- F:\DATEV\PROGRAMM\INSTALL\DvInesASDSvc.Exe (DATEV eG)
SRV - (avgwd) -- C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (DVckService) -- F:\DATEV\PROGRAMM\B0000150\ScServer\DVckService.exe (DATEV eG)
SRV - (SCardService) -- F:\DATEV\PROGRAMM\B0000347\ScMgmt\SCardService.exe (DATEV eG)
SRV - (StorSvc) -- C:\Windows\System32\StorSvc.dll (Microsoft Corporation)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (DatevPrintService) -- F:\DATEV\PROGRAMM\B0001442\PSNTServ.exe (DATEV eG)
SRV - (ScReadSpool) -- C:\Programme\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe (VoyagerSoft, LLC)
SRV - (Apache2) -- C:\Program Files\TC\Server\xampplite\apache\bin\Apache.exe (Apache Software Foundation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (MBAMSwissArmy) -- C:\Windows\System32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (SCR3XX2K) -- C:\Windows\System32\drivers\SCR3XX2K.sys (SCM Microsystems Inc.)
DRV - (Avgtdix) -- C:\Windows\System32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) -- C:\Windows\system32\DRIVERS\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgmfx86) -- C:\Windows\System32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (truecrypt) -- C:\Windows\System32\drivers\truecrypt.sys (TrueCrypt Foundation)
DRV - (AVGIDSEH) -- C:\Windows\system32\DRIVERS\AVGIDSEH.Sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgldx86) -- C:\Windows\System32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (vmbus) -- C:\Windows\system32\drivers\vmbus.sys (Microsoft Corporation)
DRV - (storflt) -- C:\Windows\system32\drivers\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) -- C:\Windows\system32\drivers\storvsc.sys (Microsoft Corporation)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (RdpVideoMiniport) -- C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV - (VMBusHID) -- C:\Windows\system32\drivers\VMBusHID.sys (Microsoft Corporation)
DRV - (s3cap) -- C:\Windows\system32\drivers\vms3cap.sys (Microsoft Corporation)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (L1E) -- C:\Windows\System32\drivers\L1E62x86.sys (Atheros Communications, Inc.)
DRV - (MTsensor) -- C:\Windows\System32\drivers\ATKACPI.sys (ATK0100)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://192.168.135.64/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 81 3A 6B 5D D3 D1 CB 01  [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.669: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.669: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2012.02.03 09:23:25 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.02.04 00:34:56 | 000,000,000 | ---D | M]
 
[2012.02.04 14:02:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\S. Hoffmann\AppData\Roaming\mozilla\Extensions
[2012.01.19 10:58:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\S. Hoffmann\AppData\Roaming\mozilla\Extensions-BackupByFirefoxPortable
[2012.01.19 10:58:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\S. Hoffmann\AppData\Roaming\mozilla\Extensions-BackupByFirefoxPortable\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
 
O1 HOSTS File: ([2011.02.22 10:35:48 | 000,001,565 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: 192.168.128.1        ps1
O1 - Hosts: 192.168.128.2        ps2
O1 - Hosts: 192.168.128.3        ps3
O1 - Hosts: 192.168.135.1        tc1
O1 - Hosts: 192.168.135.2        tc2
O1 - Hosts: 192.168.135.3        tc3
O1 - Hosts: 192.168.135.5        tc5
O1 - Hosts: 192.168.135.6        tc1a
O1 - Hosts: 192.168.135.12        tc12
O1 - Hosts: 192.168.135.12        kulsa-ag.finanzen
O1 - Hosts: 192.168.135.12        tc-franchise-rechnungen
O1 - Hosts: 192.168.135.12        dawo-rechnungen
O1 - Hosts: 192.168.135.62        tc-notes-behringen
O1 - Hosts: 192.168.135.80        tcfda
O1 - Hosts: 192.168.135.80  pathchecker
O1 - Hosts: 192.168.135.80  tcnet
O1 - Hosts: 192.168.135.82  tc-script
O1 - Hosts: 192.168.136.1        berlin
O1 - Hosts: 192.168.136.5        polen
O1 - Hosts: 192.168.136.6        esb
O1 - Hosts: 192.168.136.11        hs1
O1 - Hosts: 192.168.136.12        hs2
O1 - Hosts: 192.168.136.13        hs3
O1 - Hosts: 192.168.136.21        hs1a
O1 - Hosts: 9 more lines...
O2 - BHO: (Solid Converter PDF) - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Programme\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll (VoyagerSoft, LLC)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programme\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (SCardBHOEvent Class) - {AF8CD625-E04A-4A8F-A90A-0C74846C2E30} - F:\DATEV\SYSTEM\DVCCSASCardBHO002.dll (DATEV eG)
O3 - HKLM\..\Toolbar: (Solid Converter PDF) - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Programme\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll (VoyagerSoft, LLC)
O4 - HKLM..\Run: [AUTOSTARTEXECUTE] F:\DATEV\PROGRAMM\Install\DvInesAutostartHelper.Exe (DATEV eG)
O4 - HKLM..\Run: [AVG_TRAY] C:\Programme\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [DATEV_SCardMan] F:\DATEV\PROGRAMM\B0000347\ScMgmt\SCardManager.exe (DATEV eG)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [DVCCSAWTSSetEntryNTE] F:\DATEV\PROGRAMM\B0000150\ScWTS\DVCCSAWTSSetEntryNTE.exe (DATEV eG)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [SiPaHost] F:\DATEV\PROGRAMM\B0000398\SiPaHost.exe (DATEV eG)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: datev.at ([]http is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datev.at ([]https is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datev.com ([]http is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datev.com ([]https is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datev.de ([]http is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datev.de ([]https is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datev.de ([www] http is out of zone range -  5)
O15 - HKCU\..Trusted Domains: datev.de ([www] https is out of zone range -  5)
O15 - HKCU\..Trusted Domains: datevnet.de ([*.services] http is out of zone range -  5)
O15 - HKCU\..Trusted Domains: datevnet.de ([*.services] https is out of zone range -  5)
O15 - HKCU\..Trusted Domains: datevstadt.de ([]http is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datevstadt.de ([]https is out of zone range - 5)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.20.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{013A8FF7-8AF9-4989-97B0-480E56573584}: DhcpNameServer = 192.168.2.2
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{67F7BFFF-89AD-49CA-BB75-4382641B4CA3}: DhcpNameServer = 192.168.135.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6DB33068-86F3-4364-9E99-BAA1879D6486}: DhcpNameServer = 192.168.20.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D298D99F-289F-4D9E-B82B-7C7061AE9DB6}: DhcpNameServer = 192.168.135.254
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programme\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\ScCertProp: DllName - (wlnotify.dll) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.02.04 14:52:18 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2012.02.04 13:58:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012.02.04 13:22:02 | 000,000,000 | ---D | C] -- C:\Users\S. Hoffmann\AppData\Roaming\Malwarebytes
[2012.02.04 13:21:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.02.04 13:21:58 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.02.04 13:21:58 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.02.04 13:21:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.02.04 01:52:37 | 000,584,192 | ---- | C] (OldTimer Tools) -- F:\Desktop\OTL.exe
[2012.02.04 01:36:32 | 000,000,000 | ---D | C] -- F:\Desktop\Desktop-Zeug
[2012.02.04 00:37:58 | 000,000,000 | ---D | C] -- C:\Users\S. Hoffmann\AppData\Local\DDMSettings
[2012.02.04 00:32:03 | 000,927,072 | ---- | C] (DivX, LLC) -- F:\Desktop\DivXInstaller_8.2.1.exe
[2012.01.25 00:07:02 | 000,000,000 | ---D | C] -- F:\Desktop\Rechnung Zalando-Dateien
[2012.01.19 15:14:28 | 000,314,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\webio.dll
[2012.01.19 15:14:28 | 000,015,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sspisrv.dll
[2012.01.19 10:58:35 | 000,000,000 | ---D | C] -- C:\Users\S. Hoffmann\AppData\Roaming\Mozilla
[2012.01.15 21:01:14 | 000,000,000 | ---D | C] -- C:\Users\S. Hoffmann\AppData\Local\FullTiltPoker
[2012.01.15 21:00:48 | 000,000,000 | ---D | C] -- C:\Program Files\Full Tilt Poker
[2012.01.11 11:17:15 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\packager.dll
[2012.01.11 11:17:14 | 001,328,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll
[2012.01.11 11:17:14 | 000,514,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\qdvd.dll
[2012.01.11 02:07:03 | 000,000,000 | ---D | C] -- F:\Desktop\Vortrag NGWS
[2010.08.25 18:59:08 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll
 
========== Files - Modified Within 30 Days ==========
 
[2012.02.04 15:09:10 | 000,654,166 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.02.04 15:09:10 | 000,616,008 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.02.04 15:09:10 | 000,130,006 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.02.04 15:09:10 | 000,106,388 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.02.04 14:58:26 | 000,014,960 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.02.04 14:58:26 | 000,014,960 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.02.04 14:52:18 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2012.02.04 14:50:18 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.02.04 13:58:13 | 000,000,967 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.02.04 13:46:03 | 000,001,225 | ---- | M] () -- C:\prefs.js
[2012.02.04 13:21:59 | 000,001,069 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.02.04 12:58:34 | 000,293,374 | ---- | M] () -- C:\Windows\System32\drivers\AVG\iavichjg.avm
[2012.02.04 11:10:12 | 088,114,249 | ---- | M] () -- C:\Windows\System32\drivers\AVG\incavi.avm
[2012.02.04 01:52:38 | 000,584,192 | ---- | M] (OldTimer Tools) -- F:\Desktop\OTL.exe
[2012.02.04 00:34:58 | 000,002,064 | ---- | M] () -- C:\Users\Public\Desktop\DivX Plus Converter.lnk
[2012.02.04 00:34:58 | 000,001,511 | ---- | M] () -- F:\Desktop\DivX Movies.lnk
[2012.02.04 00:34:29 | 000,001,084 | ---- | M] () -- C:\Users\Public\Desktop\DivX Plus Player.lnk
[2012.02.04 00:32:03 | 000,927,072 | ---- | M] (DivX, LLC) -- F:\Desktop\DivXInstaller_8.2.1.exe
[2012.02.03 09:23:31 | 000,000,941 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2011.lnk
[2012.02.01 09:55:28 | 000,249,268 | ---- | M] () -- F:\Desktop\Rekla Ex Partner 01-12.php.pdf
[2012.02.01 09:52:39 | 000,189,041 | ---- | M] () -- F:\Desktop\Rekla akt Partner 01-12.php.pdf
[2012.01.31 02:48:58 | 000,059,618 | ---- | M] () -- F:\Desktop\Stellenbeschreibung.pdf
[2012.01.25 00:07:08 | 000,006,017 | ---- | M] () -- F:\Desktop\Rechnung Zalando.htm
[2012.01.13 17:13:43 | 000,650,749 | ---- | M] () -- F:\Desktop\RV akt-LP lang.pdf
[2012.01.13 17:07:49 | 000,096,800 | ---- | M] () -- F:\Desktop\RV akt-LP kurz.pdf
[2012.01.13 17:04:29 | 000,095,139 | ---- | M] () -- F:\Desktop\RV Ex-LP lang.pdf
[2012.01.13 16:57:12 | 000,060,397 | ---- | M] () -- F:\Desktop\RV Ex-LP kurz.pdf
 
========== Files Created - No Company Name ==========
 
[2012.02.04 13:58:13 | 000,000,967 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.02.04 13:21:59 | 000,001,069 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.02.04 00:34:58 | 000,001,511 | ---- | C] () -- F:\Desktop\DivX Movies.lnk
[2012.02.04 00:34:29 | 000,001,084 | ---- | C] () -- C:\Users\Public\Desktop\DivX Plus Player.lnk
[2012.02.04 00:34:07 | 000,002,064 | ---- | C] () -- C:\Users\Public\Desktop\DivX Plus Converter.lnk
[2012.02.01 09:55:26 | 000,249,268 | ---- | C] () -- F:\Desktop\Rekla Ex Partner 01-12.php.pdf
[2012.02.01 09:52:36 | 000,189,041 | ---- | C] () -- F:\Desktop\Rekla akt Partner 01-12.php.pdf
[2012.01.31 02:48:56 | 000,059,618 | ---- | C] () -- F:\Desktop\Stellenbeschreibung.pdf
[2012.01.25 00:07:01 | 000,006,017 | ---- | C] () -- F:\Desktop\Rechnung Zalando.htm
[2012.01.13 17:13:40 | 000,650,749 | ---- | C] () -- F:\Desktop\RV akt-LP lang.pdf
[2012.01.13 17:07:48 | 000,096,800 | ---- | C] () -- F:\Desktop\RV akt-LP kurz.pdf
[2012.01.13 17:04:27 | 000,095,139 | ---- | C] () -- F:\Desktop\RV Ex-LP lang.pdf
[2012.01.13 16:57:10 | 000,060,397 | ---- | C] () -- F:\Desktop\RV Ex-LP kurz.pdf
[2011.09.14 07:20:31 | 000,098,304 | ---- | C] () -- C:\Windows\System32\redmonnt.dll
[2011.06.07 07:18:39 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2011.05.03 08:33:56 | 000,004,096 | -H-- | C] () -- C:\Users\S. Hoffmann\AppData\Local\keyfile3.drm
[2011.03.18 09:52:45 | 000,000,021 | ---- | C] () -- C:\Windows\DvInesKurusOleServer003.INI
[2011.03.18 09:51:36 | 000,000,088 | ---- | C] () -- C:\Windows\dvinesinstalllocation001.INI
[2011.03.18 09:51:35 | 000,000,088 | ---- | C] () -- C:\Windows\dvinesinstart001.INI
[2011.03.18 09:49:25 | 000,000,089 | ---- | C] () -- C:\Windows\Startup.INI
[2011.02.23 13:23:49 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe
[2011.02.23 13:22:49 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2010.08.25 19:30:02 | 000,439,308 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin
[2010.08.25 19:30:00 | 000,982,240 | ---- | C] () -- C:\Windows\System32\igkrng500.bin
[2010.08.25 19:30:00 | 000,092,356 | ---- | C] () -- C:\Windows\System32\igfcg500m.bin
[2010.08.25 18:57:00 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config
[2010.08.25 18:52:00 | 000,208,896 | ---- | C] () -- C:\Windows\System32\iglhsip32.dll
[2010.08.25 18:52:00 | 000,143,360 | ---- | C] () -- C:\Windows\System32\iglhcp32.dll
[2009.09.17 14:07:34 | 000,038,496 | ---- | C] () -- C:\Windows\System32\JNILibrary.dll
[2009.09.17 14:07:26 | 000,112,224 | ---- | C] () -- C:\Windows\System32\INetCert.dll
[2009.09.01 01:11:21 | 000,654,166 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2009.09.01 01:11:21 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2009.09.01 01:11:21 | 000,130,006 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2009.09.01 01:11:21 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2009.07.14 05:55:27 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 05:02:04 | 000,472,376 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009.07.14 03:05:48 | 000,616,008 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009.07.14 03:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009.07.14 03:05:48 | 000,106,388 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009.07.14 03:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009.07.14 03:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009.07.14 03:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009.07.14 00:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009.07.13 23:09:19 | 000,139,824 | ---- | C] () -- C:\Windows\System32\igfcg500.bin
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

< End of report >
und Extra.txt

Code:
OTL Extras logfile created on: 04.02.2012 15:33:53 - Run 2
OTL by OldTimer - Version 3.2.31.0    Folder = F:\Desktop
 Enterprise Edition N Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,97 Gb Total Physical Memory | 1,10 Gb Available Physical Memory | 56,15% Memory free
6,85 Gb Paging File | 5,81 Gb Available in Paging File | 84,86% Paging File free
Paging file location(s): f:\pagefile.sys 5000 5000 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 24,32 Gb Total Space | 9,68 Gb Free Space | 39,81% Space Free | Partition Type: NTFS
Drive F: | 208,47 Gb Total Space | 194,66 Gb Free Space | 93,37% Space Free | Partition Type: NTFS
Drive X: | 3,99 Gb Total Space | 3,99 Gb Free Space | 100,00% Space Free | Partition Type: FAT32
 
Computer Name: NB-SHO | User Name: S. Hoffmann | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "F:\APP\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "F:\APP\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 24
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5FCFEBE0-EBDA-42A5-BC6E-67B94A47D6F0}" = kobdfu x64x86 driver installation
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{735DEB9C-61BD-4D31-994B-92395BBB4E45}" = Microsoft XML Parser
"{73AA12E1-5FFD-4545-9A28-CE7C318F284E}" = AVG 2011
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{A0516415-ED61-419A-981D-93596DA74165}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{26454C26-D259-4543-AA60-3189E09C5F76}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00B2-0409-0000-0000000FF1CE}" = Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{9BC76CCE-A9EC-4A3A-9B51-D823805E1D1F}" = SolidConverterPDF
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.0) - Deutsch
"{E533E637-FB3E-4F28-8B18-449CC9AB7235}" = AVG 2011
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Photoshop 7.0" = Adobe Photoshop 7.0
"AVG" = AVG 2011
"CCleaner" = CCleaner
"DATEVB00000482.0" = DATEV Installation V.2.8
"DivX Setup" = DivX-Setup
"ENTERPRISE" = Microsoft Office Enterprise 2007
"InfraRecorder" = InfraRecorder
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.60.1.1000
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"RealPlayer 12.0" = RealPlayer
"TrueCrypt" = TrueCrypt
"UTAX TA Product Library" = UTAX TA Product Library
"VLC media player" = VLC media player 1.1.11
"WinRAR archiver" = WinRAR 4.01 (32-Bit)
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"FoxTab PDF Creator" = FoxTab PDF Creator
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 04.02.2012 06:40:10 | Computer Name = NB-SHO | Source = VSS | ID = 13
Description =
 
Error - 04.02.2012 06:40:10 | Computer Name = NB-SHO | Source = VSS | ID = 8193
Description =
 
Error - 04.02.2012 06:40:10 | Computer Name = NB-SHO | Source = VSS | ID = 13
Description =
 
Error - 04.02.2012 06:40:10 | Computer Name = NB-SHO | Source = VSS | ID = 8193
Description =
 
Error - 04.02.2012 06:40:10 | Computer Name = NB-SHO | Source = VSS | ID = 13
Description =
 
Error - 04.02.2012 06:40:10 | Computer Name = NB-SHO | Source = VSS | ID = 8193
Description =
 
Error - 04.02.2012 08:48:00 | Computer Name = NB-SHO | Source = VSS | ID = 13
Description =
 
Error - 04.02.2012 08:48:00 | Computer Name = NB-SHO | Source = VSS | ID = 8193
Description =
 
Error - 04.02.2012 08:52:29 | Computer Name = NB-SHO | Source = VSS | ID = 13
Description =
 
Error - 04.02.2012 08:52:29 | Computer Name = NB-SHO | Source = VSS | ID = 8193
Description =
 
[ OSession Events ]
Error - 04.07.2011 05:57:19 | Computer Name = NB-SHO | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session
lasted 3460 seconds with 1860 seconds of active time.  This session ended with a
 crash.
 
Error - 04.07.2011 07:04:42 | Computer Name = NB-SHO | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session
lasted 1105 seconds with 240 seconds of active time.  This session ended with a
crash.
 
Error - 04.07.2011 08:16:59 | Computer Name = NB-SHO | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session
lasted 4210 seconds with 180 seconds of active time.  This session ended with a
crash.
 
[ System Events ]
Error - 23.12.2011 04:56:17 | Computer Name = NB-SHO | Source = Schannel | ID = 36870
Description = Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der
 Anmeldeinformationen Client für SSL. Der vom kryptografischen Modul zurückgegebene
 Fehlercode lautet 0x8009030d. Der interne Fehlerstatus ist 10003.
 
Error - 23.12.2011 04:56:19 | Computer Name = NB-SHO | Source = Schannel | ID = 36870
Description = Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der
 Anmeldeinformationen Client für SSL. Der vom kryptografischen Modul zurückgegebene
 Fehlercode lautet 0x8009001d. Der interne Fehlerstatus ist 10014.
 
Error - 23.12.2011 04:56:19 | Computer Name = NB-SHO | Source = Schannel | ID = 36870
Description = Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der
 Anmeldeinformationen Client für SSL. Der vom kryptografischen Modul zurückgegebene
 Fehlercode lautet 0x8009030d. Der interne Fehlerstatus ist 10003.
 
Error - 23.12.2011 04:56:20 | Computer Name = NB-SHO | Source = Schannel | ID = 36870
Description = Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der
 Anmeldeinformationen Client für SSL. Der vom kryptografischen Modul zurückgegebene
 Fehlercode lautet 0x8009001d. Der interne Fehlerstatus ist 10014.
 
Error - 23.12.2011 04:56:20 | Computer Name = NB-SHO | Source = Schannel | ID = 36870
Description = Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der
 Anmeldeinformationen Client für SSL. Der vom kryptografischen Modul zurückgegebene
 Fehlercode lautet 0x8009030d. Der interne Fehlerstatus ist 10003.
 
Error - 23.12.2011 04:56:21 | Computer Name = NB-SHO | Source = Schannel | ID = 36870
Description = Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der
 Anmeldeinformationen Client für SSL. Der vom kryptografischen Modul zurückgegebene
 Fehlercode lautet 0x8009001d. Der interne Fehlerstatus ist 10014.
 
Error - 23.12.2011 04:56:21 | Computer Name = NB-SHO | Source = Schannel | ID = 36870
Description = Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der
 Anmeldeinformationen Client für SSL. Der vom kryptografischen Modul zurückgegebene
 Fehlercode lautet 0x8009030d. Der interne Fehlerstatus ist 10003.
 
Error - 01.01.2012 15:32:36 | Computer Name = NB-SHO | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?29.?12.?2011 um 01:17:25 unerwartet heruntergefahren.
 
Error - 01.01.2012 15:45:06 | Computer Name = NB-SHO | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?01.?01.?2012 um 20:39:14 unerwartet heruntergefahren.
 
Error - 01.01.2012 16:00:15 | Computer Name = NB-SHO | Source = Microsoft-Windows-HAL | ID = 12
Description = Der Speicher wurde beim letzten Leistungsübergang des Systems von
der Plattformfirmware beschädigt. Überprüfen Sie, ob für Ihr System aktualisierte
 Firmware verfügbar ist.
 
 
< End of report >
Wenn noch etwas zu tun ist, gib mir bitte bescheid.

Tausend Dank und viele Grüße...

kira 05.02.2012 08:43
1.
Deine Javaversion ist nicht aktuell!
→ Downloade nun die Offline-Version von Java Version 6 Update 30 von Oracle herunter
Achte darauf, eventuell angebotene Toolbars abwählen (den Haken bei der Toolbar entfernen)!

2.
reinige dein System mit CCleaner:
  • "Cleaner"→ "Analysieren"→ Klick auf den Button "Start CCleaner"
  • "Registry""Fehler suchen"→ "Fehler beheben"→ "Alle beheben"
  • Starte dein System neu auf

3.
  • lade Dir SUPERAntiSpyware FREE Edition herunter.
  • installiere das Programm und update online.
  • starte SUPERAntiSpyware und klicke auf "Ihren Computer durchsuchen"
  • setze ein Häkchen bei "Kompletter Scan" und klicke auf "Weiter"
  • anschließend alle gefundenen Schadprogramme werden aufgelistet, bei alle Funde Häkchen setzen und mit "OK" bestätigen
  • auf "Weiter" klicken dann "OK" und auf "Fertig stellen"
  • um die Ergebnisse anzuzeigen: auf "Präferenzen" dann auf den "Statistiken und Protokolle" klicken
  • drücke auf "Protokoll anzeigen" - anschließend diesen Bericht bitte speichern und hier posten

4.
Auch auf USB-Sticks, selbstgebrannten Datenträgern, externen Festplatten und anderen Datenträgern können Viren transportiert werden. Man muss daher durch regelmäßige Prüfungen auf Schäden, die durch Malware ("Worm.Win32.Autorun") verursacht worden sein können, überwacht werden. Hierfür sind ser gut geegnet und empfohlen, die auf dem Speichermedium gesicherten Daten, mit Hilfe des kostenlosen Online Scanners zu prüfen.
Schließe jetzt alle externe Datenträgeran (USB Sticks etc) Deinen Rechner an, dabei die Hochstell-Taste [Shift-Taste] gedrückt halten, damit die Autorun-Funktion nicht ausgeführt wird. (So verhindest Du die Ausführung der AUTORUN-Funktion) - Man kann die AUTORUN-Funktion aber auch generell abschalten.►Anleitung

5.
-> Führe dann einen Komplett-Systemcheck mit Eset Online Scanner (NOD32)Kostenlose Online Scanner durch
Achtung!: >>Du sollst nicht die Antivirus-Sicherheitssoftware installieren, sondern dein System nur online scannen<<

► berichte erneut über den Zustand des Computers. Ob noch Probleme auftreten, wenn ja, welche?


Alle Zeitangaben in WEZ +1. Es ist jetzt 12:02 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131